Darktrace Model Breach

Back


Id	a3c7b8ed-56a9-47b7-98e5-2555c16e17c9
Rulename	Darktrace Model Breach
Description	This rule creates Microsoft Sentinel Alerts based on Darktrace Model Breaches, fetched every 5 minutes.
Severity	Medium
Required data connectors	DarktraceRESTConnector
Kind	NRT
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Darktrace/Analytic Rules/CreateAlertFromModelBreach.yaml
Version	1.0.0
Arm template	a3c7b8ed-56a9-47b7-98e5-2555c16e17c9.json

KQL

darktrace_model_alerts_CL
| where dtProduct_s =="Policy Breach"
| extend EventCount = 1
| extend EventType = "NetworkSession"
| extend EventSchema = "NetworkSession"
| extend EventSchemaVersion = "0.2.2"
| extend EventResult = "Success"
| extend DvcAction = "Allow"
| project-rename EventSeverity=score_d
| extend EventVendor = "Darktrace"
| extend EventProduct = "Enterprise Immune System"
| project-rename  EventStartTime = breachTime_s
| extend EventEndTime = EventStartTime
| project-rename NetworkRuleName=modelName_s
| project-rename NetworkRuleNumber=pid_d
| extend Rule = "NetworkRuleNumber"
| project-rename ThreatId=threatID_d
| extend ThreatName = NetworkRuleName
| project-rename ThreatCategory=dtProduct_s
| extend ThreatRiskLevel=EventSeverity
| extend ThreatCategory=Category
| extend ThreatCategory=replace_regex(ThreatCategory, @'Informational', @'Low')
| extend ThreatCategory=replace_regex(ThreatCategory, @'Compliance', @'Informational')
| extend ThreatCategory=replace_regex(ThreatCategory, @'Suspicious', @'Medium')
| extend ThreatCategory=replace_regex(ThreatCategory, @'Critical', @'High')
| project-rename SrcIpAddr=SourceIP
| project-rename SrcHostname=sourceHost_s
| project-rename SrcMacAddr=sourceMac_s
| project-rename SrcPortNumber=sourcePort_s
| project-rename DstIpAddr=destIP_s
| project-rename DstPortNumber=destPort_s
| project-rename DstHostname=destHost_s
| project-rename DstMacAddr=destMac_s

YAML

queryFrequency: 5m
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: SrcHostname
    identifier: HostName
- entityType: IP
  fieldMappings:
  - columnName: SrcIPAddr
    identifier: Address
severity: Medium
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Darktrace/Analytic Rules/CreateAlertFromModelBreach.yaml
relevantTechniques: 
query: |
  darktrace_model_alerts_CL
  | where dtProduct_s =="Policy Breach"
  | extend EventCount = 1
  | extend EventType = "NetworkSession"
  | extend EventSchema = "NetworkSession"
  | extend EventSchemaVersion = "0.2.2"
  | extend EventResult = "Success"
  | extend DvcAction = "Allow"
  | project-rename EventSeverity=score_d
  | extend EventVendor = "Darktrace"
  | extend EventProduct = "Enterprise Immune System"
  | project-rename  EventStartTime = breachTime_s
  | extend EventEndTime = EventStartTime
  | project-rename NetworkRuleName=modelName_s
  | project-rename NetworkRuleNumber=pid_d
  | extend Rule = "NetworkRuleNumber"
  | project-rename ThreatId=threatID_d
  | extend ThreatName = NetworkRuleName
  | project-rename ThreatCategory=dtProduct_s
  | extend ThreatRiskLevel=EventSeverity
  | extend ThreatCategory=Category
  | extend ThreatCategory=replace_regex(ThreatCategory, @'Informational', @'Low')
  | extend ThreatCategory=replace_regex(ThreatCategory, @'Compliance', @'Informational')
  | extend ThreatCategory=replace_regex(ThreatCategory, @'Suspicious', @'Medium')
  | extend ThreatCategory=replace_regex(ThreatCategory, @'Critical', @'High')
  | project-rename SrcIpAddr=SourceIP
  | project-rename SrcHostname=sourceHost_s
  | project-rename SrcMacAddr=sourceMac_s
  | project-rename SrcPortNumber=sourcePort_s
  | project-rename DstIpAddr=destIP_s
  | project-rename DstPortNumber=destPort_s
  | project-rename DstHostname=destHost_s
  | project-rename DstMacAddr=destMac_s  
id: a3c7b8ed-56a9-47b7-98e5-2555c16e17c9
triggerOperator: gt
version: 1.0.0
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  SrcMacAddr: SrcMacAddr
  EventTitle: NetworkRuleName
  EventStartTime: EventStartTime
  DstHostname: DstHostname
  EventSeverity: EventSeverity
  EventID: ThreatId
  DstIpAddr: DstIpAddr
  EventMessage: Message
description: |
    'This rule creates Microsoft Sentinel Alerts based on Darktrace Model Breaches, fetched every 5 minutes.'
queryPeriod: 5m
alertDetailsOverride:
  alertSeverityColumnName: ThreatCategory
  alertDescriptionFormat: '{{description_s}}'
  alertTacticsColumnName: 
  alertDisplayNameFormat: 'Darktrace: {{ThreatRiskLevel}} - {{NetworkRuleName}}'
requiredDataConnectors:
- connectorId: DarktraceRESTConnector
  dataTypes:
  - darktrace_model_alerts_CL
name: Darktrace Model Breach
tactics: 
kind: NRT

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a3c7b8ed-56a9-47b7-98e5-2555c16e17c9')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a3c7b8ed-56a9-47b7-98e5-2555c16e17c9')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Nrt",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "Darktrace Model Breach",
        "description": "'This rule creates Microsoft Sentinel Alerts based on Darktrace Model Breaches, fetched every 5 minutes.'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "darktrace_model_alerts_CL\n| where dtProduct_s ==\"Policy Breach\"\n| extend EventCount = 1\n| extend EventType = \"NetworkSession\"\n| extend EventSchema = \"NetworkSession\"\n| extend EventSchemaVersion = \"0.2.2\"\n| extend EventResult = \"Success\"\n| extend DvcAction = \"Allow\"\n| project-rename EventSeverity=score_d\n| extend EventVendor = \"Darktrace\"\n| extend EventProduct = \"Enterprise Immune System\"\n| project-rename  EventStartTime = breachTime_s\n| extend EventEndTime = EventStartTime\n| project-rename NetworkRuleName=modelName_s\n| project-rename NetworkRuleNumber=pid_d\n| extend Rule = \"NetworkRuleNumber\"\n| project-rename ThreatId=threatID_d\n| extend ThreatName = NetworkRuleName\n| project-rename ThreatCategory=dtProduct_s\n| extend ThreatRiskLevel=EventSeverity\n| extend ThreatCategory=Category\n| extend ThreatCategory=replace_regex(ThreatCategory, @'Informational', @'Low')\n| extend ThreatCategory=replace_regex(ThreatCategory, @'Compliance', @'Informational')\n| extend ThreatCategory=replace_regex(ThreatCategory, @'Suspicious', @'Medium')\n| extend ThreatCategory=replace_regex(ThreatCategory, @'Critical', @'High')\n| project-rename SrcIpAddr=SourceIP\n| project-rename SrcHostname=sourceHost_s\n| project-rename SrcMacAddr=sourceMac_s\n| project-rename SrcPortNumber=sourcePort_s\n| project-rename DstIpAddr=destIP_s\n| project-rename DstPortNumber=destPort_s\n| project-rename DstHostname=destHost_s\n| project-rename DstMacAddr=destMac_s\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": null,
        "techniques": null,
        "alertRuleTemplateName": "a3c7b8ed-56a9-47b7-98e5-2555c16e17c9",
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "alertDetailsOverride": {
          "alertSeverityColumnName": "ThreatCategory",
          "alertDisplayNameFormat": "Darktrace: {{ThreatRiskLevel}} - {{NetworkRuleName}}",
          "alertTacticsColumnName": null,
          "alertDescriptionFormat": "{{description_s}}"
        },
        "customDetails": {
          "SrcMacAddr": "SrcMacAddr",
          "EventTitle": "NetworkRuleName",
          "EventStartTime": "EventStartTime",
          "DstHostname": "DstHostname",
          "EventSeverity": "EventSeverity",
          "EventID": "ThreatId",
          "DstIpAddr": "DstIpAddr",
          "EventMessage": "Message"
        },
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "identifier": "HostName",
                "columnName": "SrcHostname"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "identifier": "Address",
                "columnName": "SrcIPAddr"
              }
            ]
          }
        ],
        "templateVersion": "1.0.0",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Darktrace/Analytic Rules/CreateAlertFromModelBreach.yaml"
      }
    }
  ]
}